Description / Features
This plugin imports Fortify SSC reports into Sonar:
- Import the Fortify Security Rating, value between 1 and 5
- Import the number of issues marked as critical, high, medium and low priority in Fortify
- Link to the Fortify SSC web report
|This plugin is not autonomous nor server-less|
As said in the description above, this plugin imports audit reports available in Fortify SSC Server. This means that the plugin:
As a consequence, Fortify scans must have been run before executing this plugin on Sonar.
|Multi-module projects are currently supported only for Java projetcts|
The Fortify plugin currently does not support multi-module for languages other than Java. You can watch and vote for the following JIRA ticket concerning this issue: SONARPLUGINS-2452
Here are some screenshots of the plugin:
- Install the Fortify plugin through the Update Center or download it into the SONAR_HOME/extensions/plugins directory
- Restart the Sonar server
- Configure the connection to the Fortify SSC Server in Configuration > General Settings > Fortify:
- Server URL
- Login/password. Token-based authentication is not supported yet.
- Activate some Fortify rules in the Quality Profile
- Configure the project to be analyzed:
- By default project name and version must match the name and version defined in Fortify. They can be changed in Project Settings.
- Enable audit import on the projects that have been scanned by Fortify: set
truein Project Settings.
Inspect project. The following logs should appear: